Saudi NCA ECC Implementation Training

Opens by asking which control you could show working, with evidence, in five minutes. Three events show why implementation matters: Aramco's 2021 statement that data held by third-party contractors was released, the July 2024 faulty security update that Microsoft estimated crashed about 8.5 million devices, and the April 2025 Verizon report finding a third party in 30% of breaches. The module sets out ECC-2:2024: four domains, 28 subdomains, 108 main controls and 92 subcontrols, with the Arabic text binding. It introduces the NCA's implementation guide, GECC-2:2026, with its tools, guidelines and expected deliverables, and the four steps of define, implement, minimum and review. RST Digital Services Company, a worked example of a government-owned e-services company in Riyadh with about 650 staff, is followed through the course, with roles split between CEO, head of cybersecurity, IT and internal audit.

What you will be able to do

• Describe the structure of ECC-2:2024 and the role of the NCA implementation guide
• Explain the four steps of define, implement, minimum and review behind most subdomains
• Identify who approves, leads, operates and independently reviews the controls

Why it matters

Gives cybersecurity and IT teams a clear picture of what ECC-2:2024 requires and how to plan evidence from the start of the work.

Practice: Practice: Welcome: the ECC and how to implement it · 3 questions

Begins with a government-owned company that assumed the ECC was only for ministries, contrasted with RST Digital, which checked its ownership, affiliation and infrastructure and had the CEO approve the result. The module covers why compliance is not optional, citing the NCA statute and Article 10, paragraph 3, on ongoing and continuous compliance. It quotes the scope: government agencies, their affiliates inside and outside the Kingdom, and private entities owning, operating or hosting critical national infrastructure, and explains that definition. A five-step scope decision is shown in RST Digital's one-page record, and a Dubai affiliate shows that affiliates abroad are in scope. The statement of applicability is applied to four controls, including cloud subdomain 4-2. It covers the NCA's assessment means: self-assessment, compliance tool reports and field audits, evidence that is approved, current and traceable, and a cloud applicability mistake.

What you will be able to do

• Determine whether an entity falls within ECC scope and record the decision with reasons
• Record an applicability decision with a true reason for every ECC control
• Explain how the NCA assesses compliance and what makes evidence stand up

Why it matters

Helps entities show an assessor a recorded, approved scope and applicability decision instead of relying on memory or assumptions.

Practice: Practice: Scope, applicability and compliance · 3 questions

Contrasts a team that bought tools without a map with one that rated every applicable control first. The module explains the four domains, 28 subdomains, 108 main controls and 92 subcontrols, and how to read a number such as 2-2-3-2, multi-factor authentication. It shows the four-step check of each control and the main 2024 changes: industrial systems moved to the OTCC, Saudi professionals in all cybersecurity positions, multi-factor authentication for privileged accounts, DKIM and DMARC alongside SPF, protection against denial of service, and data privacy and localisation referred to the National Data Management Office. Related NCA sets such as CCC-2:2024 and DCC-1:2022 are noted. A five-step gap assessment and Sterling's recommended scale are applied to four RST Digital lines, with a Singapore bank's lesson on rating evidence, priorities, a common mistake and the first practice exercise.

What you will be able to do

• Read an ECC control number down to the subcontrol and trace it to the text
• Run a gap assessment that rates each applicable control on evidence, not interviews
• Prioritise ECC gaps by governance dependency, risk and quick wins

Why it matters

Gives the cybersecurity department an honest baseline and a prioritised plan that can be defended to management and the NCA.

Practice: Practice: Structure, changes and the gap assessment · 3 questions

Starts with RST Digital's budget following the latest incident or vendor until a strategy with objectives and projects was approved and funded by the CEO. The module explains the subdomain's objective and its three controls. Control 1-1-1 requires the strategy to be documented and approved, supported by the head of the entity or delegate, the authorised official, and aligned with legislative and regulatory requirements. The guide's sequence of a stakeholder workshop, alignment, a written strategy and approval is applied to RST Digital's vision, mission and objectives, with initiatives traced to each. Control 1-1-2 covers the roadmap, with owner, date and measure on every line. Control 1-1-3 covers reviews at planned intervals and on changes in laws or the entity. Expected deliverables, a Toronto insurer's unmeasurable strategy, key performance indicators, three habits and the downloaded-template mistake complete it.

What you will be able to do

• Write a cybersecurity strategy with a vision, mission and measurable objectives
• Build a roadmap where every initiative has an owner, a due date and a measure
• Plan strategy reviews at set intervals and when laws or the entity change

Why it matters

Turns cybersecurity spending into traceable progress the head of the entity can explain and the NCA can see evidenced.

Practice: Practice: Cybersecurity strategy · 3 questions

Starts with RST Digital's security lead reporting to an IT director whose uptime and cost targets softened risks before they reached the CEO. The module explains the subdomain's objective and control 1-2-1: a cybersecurity department independent from IT, required, and reporting to the head of the entity, recommended. The guide's four set-up points are applied to the decision RST Digital's CEO signed, and a Hong Kong logistics company shows why nobody should review their own systems. Control 1-2-2, extended in ECC-2:2024 to all cybersecurity positions, requires full-time, qualified Saudi professionals, using the Saudi Cybersecurity Workforce Framework and a detailed personnel list, shown field by field. Control 1-2-3 covers the supervisory committee: members, an approved charter, the head of cybersecurity as a member, meetings and minutes sent to the head of the entity. Expected deliverables and the forgotten-committee mistake close it.

What you will be able to do

• Set up a cybersecurity department independent from IT with a documented mandate
• Maintain a cybersecurity personnel list showing roles, contracts, experience and qualifications
• Write a supervisory committee charter and keep minutes with owned, dated actions

Why it matters

Lets difficult cyber risks reach the head of the entity and gives an assessor clear evidence of independence, staffing and oversight.

Practice: Practice: The department, staff and the committee · 3 questions

Begins with RST Digital's six policies, one saying only that systems must be kept secure, so every engineer configured systems differently. The module covers the subdomain's objective and control 1-3-1: the department documents policies and procedures, the authorised official approves them under the authority matrix, and they are communicated. It shows Sterling's recommended four layers of general policy, topic policies, procedures and technical standards, and the ECC definitions of each. Control 1-3-2 requires an implementation action plan and monitoring, with four RST Digital lines. Control 1-3-3 requires technical security standards for assets such as firewalls, databases and operating systems, with a sample server standard. Control 1-3-4 sets reviews at planned intervals and when requirements change. Expected deliverables, a London firm's ninety-page policy, four control fields per document and the missing-standards mistake complete it.

What you will be able to do

• Structure a policy library into policies, procedures and technical security standards
• Build an action plan that shows each policy is implemented and checked
• Write a technical standard defining secure settings for a type of system

Why it matters

Turns secure from a vague word into defined settings that engineers apply and an assessor can check across every system.

Practice: Practice: Policies, procedures and technical standards · 3 questions

Opens with a suspicious login alert at RST Digital that the IT team, monitoring partner and help desk each left to the others for three hours. The module explains control 1-4-1: the authorised official identifies, documents and approves the governance structure, roles and responsibilities, assigns people and provides support without conflicts of interest. The guide's five groups of roles are shown in RST Digital's roles document, with roles named by title and a separate assignment list. An access request process shows segregation of duties, and a Manila contact centre team lead who approved her own payroll access shows the risk. Control 1-4-2 covers reviews. Subdomain 1-7 and control 1-7-1 require identifying and complying with nationally approved international commitments, after the 2024 deletion of the general control on national laws. A recommended list format, deliverables, the named-individuals mistake and the first written exercise follow.

What you will be able to do

• Write a roles document by title, backed by a current assignment list
• Build segregation of duties into processes such as access requests
• Keep a list of international cybersecurity commitments with owners and compliance status

Why it matters

Makes sure every alert and control has a named owner, no one approves their own access, and commitments are tracked.

Practice: Practice: Roles, responsibilities and commitments · 3 questions

Begins with RST Digital teams scoring risks in their own ways, so budgets followed whoever argued loudest. The module explains the subdomain's objective, the ECC definition of cyber risks and control 1-5-1: an approved methodology covering confidentiality, integrity and availability, with the guide's five parts from asset value to monitoring. Sterling's recommended four-level likelihood and impact scales, score bands and decision rights are set out, with impact examples from RST Digital's portals. Four treatment responses are explained. Control 1-5-2 applies the method through a risk register and treatment plans, shown with a critical risk to administrator accounts treated by multi-factor authentication. Control 1-5-3 requires assessments early in projects, before major changes, when planning third-party services and before releases, with a Sydney university that assessed a cloud contract too late. Control 1-5-4 reviews the method, followed by deliverables and a practice exercise.

What you will be able to do

• Write a risk methodology with defined likelihood and impact scales and decision rights
• Record a risk with its score, treatment, owner, date and residual score
• Build risk assessments into projects, changes, procurement and releases

Why it matters

Gives the entity one comparable view of its cyber risks so funding goes to the biggest ones and assessments happen in time.

Practice: Practice: Cybersecurity risk management · 3 questions

Contrasts two RST Digital portal projects: one scanned the week before launch and delayed two months, the other with security gates from the start that launched on time. The module explains the subdomain's objective and control 1-6-1, putting cybersecurity requirements into project methodology and change management, with the guide's four requirements from pre-launch vulnerability assessment to connecting new systems to monitoring. RST Digital's project gates are shown in Sterling's recommended format. Control 1-6-2 sets the minimum of vulnerability assessment and remediation and configuration, hardening and update reviews, linked to the July 2024 faulty update. Control 1-6-3 adds secure coding standards, trusted and licensed tool and library sources, security testing, secure integration and a hardening review, with a hardened image. A Mumbai development partner pulling an unchecked package, control 1-6-4 reviews, deliverables and the skipped firewall change mistake follow.

What you will be able to do

• Build security gates into project stages, from risk assessment to go-ahead
• Apply vulnerability scans and hardening reviews to changes as well as projects
• Enforce secure coding and an approved list of development tools and libraries

Why it matters

Moves security work to the start of projects and changes, avoiding late launch delays and risky small changes that bypass checks.

Practice: Practice: Cybersecurity in projects and change · 3 questions

Starts with RST Digital's department reporting almost everything in place until a penetration test found a forgotten administrator account. The module explains the subdomain's objective, the ECC definition of audit and control 1-8-1: periodic review by the department under an approved plan, with RST Digital's quarterly split and a recommended method for reviewing one control. Control 1-8-2 requires review and audit by parties other than the department, independently and following the Generally Accepted Auditing Standards, by internal audit or an independent external auditor. It explains who can and cannot audit, with a London affiliate whose security operations provider audited its own service. Control 1-8-3 requires results with scope, observations, recommendations, corrective actions and remediation plans presented to the committee and authorised official, shown through a leavers' accounts finding tracked to re-test. Deliverables, three habits and the filed-report mistake close it.

What you will be able to do

• Plan quarterly department reviews that cover every applicable control each year
• Explain who may carry out the independent audit required by control 1-8-2
• Track audit findings to closure with owners, dates and a re-test

Why it matters

Gives the head of the entity an honest, independent view of whether controls work, with findings that close for good.

Practice: Practice: Periodical review and independent audit · 3 questions

Opens with RST Digital's leavers who kept working accounts because HR never told IT, fixed by a clearance form triggered by every exit. The module explains the subdomain's objective, the ECC definition of staff including contractors, and controls 1-9-1 and 1-9-2: an approved HR cybersecurity policy and its implementation. Controls 1-9-3 to 1-9-5 set the minimum: responsibility and non-disclosure clauses in contracts, screening or vetting for cybersecurity and privileged technical roles, awareness and policy acceptance during employment, and immediate review and revocation of powers at the end. RST Digital's HR procedure and Sterling's recommended joiner, mover and leaver triggers are shown. A Dubai logistics firm whose contractors bypassed HR and a finance analyst keeping old access after a move illustrate the gaps. Control 1-9-6 reviews, indicators, deliverables and the quarterly-review mistake complete it.

What you will be able to do

• Build cybersecurity steps into HR procedures for joiners, movers and leavers
• Apply screening and non-disclosure requirements to employees and contractors alike
• Revoke all access on the last day and keep a signed clearance form as evidence

Why it matters

Closes the hand-over gap between HR and IT that leaves leavers' accounts open, with signed records an assessor can check.

Practice: Practice: Cybersecurity in human resources · 3 questions

Begins with RST Digital's yearly click-through slides and flat phishing results, replaced by monthly messages, simulations, workshops and role-based training. The module explains the subdomain's objective, recalling the Verizon finding of a human element in about 60% of breaches. Control 1-10-1 requires a multi-channel programme, periodically developed and approved, shown through RST Digital's yearly plan. Control 1-10-2 covers implementation, evaluating awareness and a list of beneficiaries including contractors. Control 1-10-3 names four topics: e-mail and phishing, mobile devices and storage media, internet browsing and social media. Control 1-10-4 requires specialised training for cybersecurity staff, developers and operators, and executives, including whaling. A New York retailer's near-paid fake CEO request shows why. Three habits, control 1-10-5 review measures, deliverables, the completion-rate mistake and a practice exercise follow.

What you will be able to do

• Plan a yearly awareness programme covering the four topics control 1-10-3 requires
• Design specialised training for cybersecurity staff, developers, operators and leaders
• Measure awareness by behaviour, such as phishing clicks and reports, not attendance

Why it matters

Turns awareness from a yearly tick-box into a programme that changes behaviour and leaves the training records the NCA expects.

Practice: Practice: The awareness and training programme · 3 questions

Opens the defence domain with a forgotten RST Digital test server, in no list, never patched and full of known vulnerabilities. The module explains the subdomain's objective, the ECC definition of an asset and control 2-1-1: approved requirements covering asset types, classification levels, lifecycle stages and ownership. Control 2-1-2 builds a single register, in a spreadsheet or configuration management database, shown with four RST Digital lines from the citizen portal database to network printers. Controls 2-1-3 and 2-1-4 cover an acceptable use policy with rules, clear examples of unacceptable use, consequences and monitoring, accepted by every employee. Control 2-1-5 covers classification, labelling and handling as the relevant laws and regulations say, with a Sydney university whose coded labels staff ignored. Control 2-1-6 reviews, checking the register against network scans, deliverables and the missing-applications mistake complete it.

What you will be able to do

• Build a single asset register with an owner and classification for every asset
• Write an acceptable use policy with clear examples of unacceptable use
• Check the asset register against network scans to find unlisted devices

Why it matters

Gives the entity a current picture of every asset it must protect, so nothing sits unpatched and unmonitored outside the register.

Practice: Practice: Asset management · 3 questions

Begins with RST Digital administrator accounts protected by passwords alone, one reused on a site that leaked it. The module explains the subdomain's objective, the difference between authentication and authorisation, and controls 2-2-1 and 2-2-2 on an approved policy and its implementation. Control 2-2-3 sets five subcontrols. Single-factor authentication needs unique identifiers and a password standard. Multi-factor authentication, extended in ECC-2:2024 to privileged accounts, uses factors chosen by assessing the impact of failure or bypass, shown through four RST Digital decisions. Authorisation follows need to know and need to use, least privilege and segregation of duties through a central system. Privileged access management keeps admin accounts away from daily work, illustrated by a Hong Kong hosting company administrator who browsed with admin rights. Periodic access reviews using the guide's removal cases, deliverables and the one-click review mistake complete it.

What you will be able to do

• Choose multi-factor authentication factors by assessing the impact of a bypass
• Separate privileged accounts from daily work, browsing and e-mail
• Run an access review that removes unused, conflicting, unconfirmed and expired access

Why it matters

Protects the accounts attackers want most, so a stolen password alone cannot give control of the entity's core systems.

Practice: Practice: Identity and access management · 3 questions

Starts with RST Digital patching whenever teams found time, leaving servers months behind. The module explains the subdomain's objective and controls 2-3-1 and 2-3-2: an approved protection policy and its implementation. The four minimum items of control 2-3-3 follow. Malware protection, including protection against advanced persistent threats, covers every workstation and server, with coverage reviewed from the central console. External storage media are blocked by default, with documented, time-limited exceptions. Patch management sets scope and time limits by criticality inside change management, with Sterling's recommended limits of seven days for critical internet-facing patches and a five-step monthly cycle. Centralised clock synchronisation uses a trusted source such as the Kingdom's national standards and metrology body. Hardened secure builds, a Dubai retailer's tills that stopped reporting to antivirus, deliverables and the open-ended USB exception mistake complete it.

What you will be able to do

• Set patch time limits by system criticality and route patches through change management
• Block external storage media by default with time-limited, approved exceptions
• Reconcile malware protection coverage with the asset register

Why it matters

Turns patching and malware protection into managed, measured controls with deadlines and coverage reports an assessor can verify.

Practice: Practice: Protecting systems and processing facilities · 3 questions

Opens with fake invoices sent from what looked like an RST Digital address because its domain had only a partial SPF record. The module explains the subdomain's objective and controls 2-4-1 and 2-4-2, opening RST Digital's two-page e-mail security policy and rules on shared mailboxes, attachment limits and a load balancer. The five minimum items follow: analysing and filtering phishing and spam, multi-factor authentication for remote and webmail access chosen by impact, archiving and backup with set retention, protection against advanced persistent threats and zero-day malware, and domain validation with SPF, DKIM and DMARC, the last two added in ECC-2:2024. It explains each record and the path from DMARC monitoring to rejection. A London firm paying a look-alike supplier shows why procedures matter too. A sign-off and evidence trail, the assessor's view and the DMARC left in monitoring mistake complete it.

What you will be able to do

• Configure SPF, DKIM and DMARC and move DMARC from monitoring to enforcement
• Apply filtering, advanced threat protection and multi-factor webmail access
• Assemble the e-mail evidence file an assessor will ask to see

Why it matters

Stops criminals sending mail in the entity's name and reduces phishing risk, with settings and records ready for an NCA assessment.

Practice: Practice: E-mail protection · 3 questions

Starts with RST Digital's flat network, where one infected laptop could have reached the citizen database. The module explains the subdomain's objective and the nine subcontrols of control 2-5-3, the ninth on denial of service added in ECC-2:2024. Controls 2-5-1 and 2-5-2 cover an approved policy, technical standards for every network device and implementation samples, opening RST Digital's network standard. Segmentation by trust level, firewalls, a demilitarised zone and defence in depth are shown through four RST Digital zones. Isolating production from test and development follows, with a Toronto insurer whose forgotten test-to-production link let malware cross. The remaining subcontrols cover secure browsing, wireless after a risk assessment, restricted ports and protocols, intrusion prevention, DNS security, browsing protection against advanced threats and denial of service protection with the provider. A firewall rule review, a rule register line, the assessor's view and the never-removed rules mistake complete it.

What you will be able to do

• Design network zones by trust level with firewalls and a demilitarised zone
• Isolate production from test and development and check for shortcuts at every review
• Run a firewall rule review that gives every rule a reason, owner and review date

Why it matters

Limits how far an attacker can move after one device is compromised, and leaves network evidence an assessor can trace rule by rule.

Practice: Practice: Network security management · 3 questions

Contrasts two lost RST Digital phones: one with unprotected work e-mail, the other with an encrypted, managed container wiped within minutes. The module explains the subdomain's objective, the ECC definition of bring your own device and controls 2-6-1 and 2-6-2: an approved policy and standard, central management through a directory service or management system, group policy, hardening, encrypted storage and remote wipe. The four minimum items of control 2-6-3 follow: separation and encryption, controlled and restricted use, deletion on loss or end of employment, and user awareness. RST Digital's device standard and use matrix are shown in Sterling's recommended format, with a lost-device drill and a help desk record wiped twelve minutes after a report. A Singapore bank leaver's cached e-mail and a Sydney retailer's optional enrolment illustrate gaps. Sign-off, the evidence file, the assessor's view and the unmanaged personal phone mistake complete it.

What you will be able to do

• Keep entity data on mobile and personal devices separated, encrypted and centrally managed
• Build a device use matrix that limits access by how much control the entity has
• Run a lost-device drill and record the time from report to remote wipe

Why it matters

Makes sure entity data on laptops, phones and personal devices can be wiped fast when a device is lost or an employee leaves.

Practice: Practice: Mobile devices security · 3 questions

Begins with RST Digital storing citizen identity records and the canteen menu in the same folders with the same permissions. The module explains the subdomain's objective and the ECC-2:2024 change to classification-based implementation. Control 2-7-1 requires approved data protection requirements in line with the National Data Management Office's policies, covering protection, ownership, classification and labelling, and privacy. It explains that entities refer data privacy and localisation to that office, within the Saudi Data and Artificial Intelligence Authority, before acting. Data ownership is set out, then control 2-7-2 implementation by classification, with RST Digital's handling rules for four levels linked to subdomains 2-2, 2-8 and 2-12. A Mumbai developer copying live data into test and a London report sent to partners illustrate the risks. Control 2-7-3 reviews, the policy, a data register line, sign-off, the assessor's view and the labels-only mistake follow.

What you will be able to do

• Write handling rules for each classification level covering storage, access and encryption
• Assign data owners and keep a data register showing where every copy is stored
• Explain when data privacy and localisation questions go to the National Data Management Office

Why it matters

Puts the strongest protection on the most sensitive data and shows an assessor that classification really changes handling.

Practice: Practice: Data and information protection · 3 questions

Opens with an expired certificate that took an RST Digital citizen portal offline on a Saturday because nobody owned it. The module explains the subdomain's objective, the ECC definition of cryptography and the central requirement of control 2-8-3: requirements include at least the NCA's National Cryptographic Standards, at a level set by data sensitivity and risk. Controls 2-8-1 and 2-8-2 cover an approved policy, approved hash functions and certificates from a trusted third party, with RST Digital's cryptography standard. The three subcontrols follow: approved algorithms, protocols and public key infrastructure; key lifecycle management; and encryption in transit and at rest by classification. A key and certificate register line with renewal sixty days ahead, a New York firm storing its backup key on the same server and a London retailer reusing one key on forty servers are shown. Renewals, quarterly configuration scans and the outdated-protocols mistake complete it.

What you will be able to do

• Build a cryptography standard from the National Cryptographic Standards at the right level
• Keep a key and certificate register with owners, expiry dates and renewal alerts
• Check system settings against the standard with a configuration scan

Why it matters

Prevents certificate outages and weak encryption, and shows an assessor that encryption follows the national standards in practice.

Practice: Practice: Cryptography · 3 questions

Opens with the April 2025 Verizon finding of ransomware in 44% of breaches and RST Digital's nightly backups that had never been restored, one of which proved incomplete. The module explains the subdomain's objective, which covers technical configurations as well as data, and control 2-9-1 on an approved policy, opening RST Digital's backup and recovery procedure. The three minimum items of control 2-9-3 follow: a scope covering databases, applications, servers and network devices, quick recovery after incidents, and periodic recovery testing with times recorded. Online and offline backups are explained from the ECC glossary, with RST Digital's backup periods and tests in Sterling's recommended format. A Dubai logistics company without configuration backups, a restore test record of just under three hours and a London law firm whose plugged-in backup disk was encrypted illustrate the points. An offline copy check, deliverables and the one-small-file test mistake complete it.

What you will be able to do

• Define backup scope and periods for databases, applications, servers and network devices
• Run and record restore tests on critical systems, including how long each took
• Keep at least one backup copy offline and check monthly that it can be read

Why it matters

Shows the entity can actually restore its critical services after ransomware or failure, with dated restore records an assessor accepts.

Practice: Practice: Backup and recovery · 3 questions

Begins with the Verizon finding that exploited vulnerabilities were the way in for 20% of breaches, and RST Digital's yearly scan report that was filed and forgotten. The module explains the subdomain's objective, the ECC definition of a vulnerability and controls 2-10-1 and 2-10-2: an approved policy, escalation and a link to patch management, opening RST Digital's procedure and Sterling's recommended split between the cybersecurity function that finds and the teams that fix. The five minimum items of control 2-10-3 form a cycle: periodic assessment, classification by severity, remediation by rating and risk with time limits matching Module 15, patches verified outside production, and trusted sources, with staged roll-out recalling July 2024. A London affiliate that missed a vendor notice, a finding tracked from scan to rescan, a Sydney university's exception with no end date, a monthly report and the closed-without-rescan mistake complete it.

What you will be able to do

• Set remediation time limits by severity and track each finding to a clean rescan
• Verify patches outside production and roll them out in stages
• Route exceptions through risk management with an owner and an end date

Why it matters

Closes known weaknesses within defined times and gives the committee clear numbers on any vulnerability that misses its limit.

Practice: Practice: Vulnerability management · 3 questions

Starts with RST Digital testing only its main website each year while the mobile app, interfaces and remote access went untested. The module explains the subdomain's objective of simulating actual attack methods, the ECC definition of penetration testing and controls 2-11-1 and 2-11-2, opening RST Digital's policy with sections on scope, frequency, testers and follow-up. The scope in subcontrol 2-11-3-1 covers all internet services with their technical components: infrastructure, websites and web applications, mobile apps, interfaces, servers, network devices, e-mail and remote access. Subcontrol 2-11-3-2 requires periodic tests on an annual plan. Sterling's recommended test steps, a Singapore office whose memory-based scope missed an old portal, a signed authorisation with a stop rule and a London insurer whose unscheduled test took a portal down are shown. Building the annual plan, deliverables, the assessor's view and the scan-as-test mistake complete it.

What you will be able to do

• Set penetration test scope from the documented list of every external service
• Write a test authorisation with scope, time window, contacts and a stop rule
• Feed test findings into vulnerability management and retest serious ones

Why it matters

Finds exploitable weaknesses in every online service before attackers do, with signed authorisations and reports ready for an assessor.

Practice: Practice: Penetration testing · 3 questions

Opens with RST Digital logs kept on each device and read only after something went wrong, now sent to one central system watched around the clock. The module explains the subdomain's objective and control 2-12-1, opening RST Digital's policy with sections on scope, logs, monitoring and retention. The five minimum items of control 2-12-3 follow: logs switched on for critical assets, logs for privileged accounts and remote access, a SIEM to collect them, continuous monitoring under an approved twenty-four-hour model, and retention of at least twelve months. It covers in-house shift tables or a contracted monitoring service with retention in the contract. A Hong Kong office whose logs were overwritten after four months, a night-time administrator sign-in from abroad locked within minutes and a London bank buried in noisy alerts are shown. A monthly SIEM coverage check, deliverables and the unconnected new systems mistake complete it.

What you will be able to do

• Switch on logs for critical assets, privileged accounts and remote access
• Choose an in-house or contracted monitoring model that covers every hour
• Check monthly that every critical asset is connected to the SIEM

Why it matters

Makes sure suspicious activity is seen and acted on quickly, with at least twelve months of logs available for any investigation.

Practice: Practice: Event logs and monitoring · 3 questions

Opens with ransomware featuring in 44% of breaches in the April 2025 Verizon report, and RST Digital's first serious incident, when nobody knew who led and NCA reporting came up only on the second day. The module explains the subdomain's objective, based on a High Order, and control 2-13-1 on an approved policy. The five minimum items of control 2-13-3 follow: a response plan with roles, emergency channels, a playbook and incident reports; classification aligned with risk, with Sterling's four recommended levels; reporting incidents to the NCA through approved channels such as the Haseen portal or official NCA e-mail; sharing notifications, threat intelligence and indicators with the NCA; and handling threat intelligence feeds within time limits. A New York office whose bulletins sat in one inbox, a contained ransomware report, a London office that filed indicators away, a yearly tabletop exercise and a practice exercise complete it.

What you will be able to do

• Write an incident response plan with severity levels, roles, channels and a playbook
• Report an incident to the NCA through approved channels with the key information
• Route threat intelligence alerts to a team and track each one until handled

Why it matters

Means the entity knows who leads, how to contain and when to report to the NCA before an incident happens, not during it.

Practice: Practice: Incident and threat management · 3 questions

Begins with a contractor's badge that still opened RST Digital's data centre a year after his project ended. The module explains the subdomain's objective and controls 2-14-1 and 2-14-2, working with the security and safety department, and opens RST Digital's physical security policy. The five minimum items of control 2-14-3 follow: authorised access to critical areas such as the data centre, recovery centre, surveillance centre and network rooms, through requests with a name, reason and duration, approval, review and revocation; access and camera records across buildings; protecting those records with separate storage, backups and a retention period; secure destruction or erasure of classified paper and media; and equipment security with a maintenance plan. A Manila office whose sold laptops leaked documents, a two-day contractor access form, a Sydney operator whose cameras kept only seven days and a quarterly access review complete it.

What you will be able to do

• Grant critical-area access with a recorded reason, duration, approval and revocation
• Protect camera and access records with separate storage, backups and set retention
• Destroy or securely erase classified paper and storage media with records kept

Why it matters

Closes the physical routes around technical controls, such as old badges and unwiped drives, and prepares the entity for assessor site visits.

Practice: Practice: Physical security · 3 questions

Starts with RST Digital's citizen portal running web pages, logic and database on one internet-facing server with no filter. The module explains the subdomain's objective and controls 2-15-1 and 2-15-2, opening RST Digital's web application protection policy and covering applications the entity builds, buys or has a supplier run. The five minimum items of control 2-15-3 follow: a web application firewall selected and installed for all applications the entity runs; a multi-tier architecture of at least presentation, business and database tiers; secure protocols such as HTTPS; a usage policy published on the application itself; and authentication factors set by an impact assessment. A Toronto office matching logins to impact, a register line for the payment portal, a London travel company's forgotten test portal with real data and a five-step go-live check are shown. Deliverables, the forgotten supplier applications mistake and the second written exercise complete it.

What you will be able to do

• Place every external web application behind a firewall with at least three tiers
• Set web application login factors from an impact assessment of bypass
• Keep a register of external applications, including supplier-run and test copies

Why it matters

Protects the entity's most exposed systems, the citizen-facing portals, and makes sure supplier-run applications meet the same controls.

Practice: Practice: Web application security · 3 questions

Opens with the July 2024 faulty update and RST Digital's continuity plan that covered fire, flood and power cuts but not a cyber attack. The module explains the objective of the only resilience subdomain and controls 3-1-1 and 3-1-2, opening the cybersecurity section of RST Digital's plan with its trigger, ranked cyber systems, deputies and recovery links. The three minimum items of control 3-1-3 follow: continuity of cybersecurity systems and procedures, with high-risk cyber incidents as a trigger, a business impact analysis, high availability and deputies; incident response plans for continuity in four phases, pointing to NCA playbooks; and disaster recovery plans with a team, a recovery centre for critical systems and periodic tests. RST Digital's recovery targets and a test meeting them within four hours, a Sydney office whose untested switch-over failed, a London firm's untrained deputy and a yearly continuity cycle complete it.

What you will be able to do

• Make a high-risk cyber incident a trigger for activating the continuity plan
• Set recovery targets from a business impact analysis and test them at the recovery site
• Name and train deputies for every person who operates a cybersecurity system

Why it matters

Brings cyber incidents into continuity planning so critical citizen services can be recovered within tested targets after an attack.

Practice: Practice: Cybersecurity resilience in continuity · 3 questions

Opens with the Verizon finding of a third party in 30% of breaches and Aramco's 2021 statement that data held by third-party contractors was released. The module explains the subdomain's objective, covering IT and cybersecurity outsourcing and managed services, and control 4-1-1 on an approved policy, opening RST Digital's third-party policy. Control 4-1-2 requires three clauses in relevant contracts: non-disclosure and secure removal of data at the end of service, incident communication procedures with contacts, reporting and escalation, and an obligation to apply the entity's requirements and the law. Control 4-1-3 adds a risk assessment before signing outsourcing or managed service contracts, and managed monitoring centres using remote access fully located in Saudi Arabia, shown through a Riyadh entity offered monitoring from Mumbai. A contract register line, a London office's supplier that kept old customer files, a five-step onboarding and the old-contracts mistake follow, with a practice exercise.

What you will be able to do

• Write the three cybersecurity clauses every relevant third-party contract needs
• Complete a risk assessment before signing outsourcing or managed service contracts
• Check that managed monitoring centres and their remote access are within the Kingdom

Why it matters

Extends the entity's cybersecurity to suppliers who hold its data or run its services, with contracts and assessments an assessor can check.

Practice: Practice: Third-party cybersecurity · 3 questions

Begins with RST Digital signing a cloud provider's standard terms without checking data return or storage location. The module explains the subdomain's objective, which applies in addition to the relevant controls in other domains, and control 4-2-1 on an approved cloud policy, opening RST Digital's policy with sections on contracts, location, data and exit. Control 4-2-2 implementation covers hosting and storage within the Kingdom, event logs for hosted assets, data return and unrecoverable removal, separation, encryption, backups and continuous compliance with CCC-2:2024. Subcontrol 4-2-3-1 requires providers to protect data by classification and return it in a usable format, and 4-2-3-2 requires the entity's environment, especially virtual servers, to be separated from other customers. A Singapore office receiving raw database files, a hosted services list line, an agreed exit procedure, a London team's uncontracted trial upload, a yearly review and the third written exercise complete it.

What you will be able to do

• Classify and label data before it is sent to a cloud or hosting provider
• Agree a data return and removal procedure before a cloud contract starts
• Obtain contract clauses and provider evidence that the environment is separated

Why it matters

Keeps responsibility for cloud-hosted data with the entity, with the contracts, data lists and exit plans the NCA expects to see.

Practice: Practice: Cloud computing and hosting · 3 questions

Starts with RST Digital's first self-assessment, two weeks spent searching inboxes for approvals, now replaced by evidence filed as work is done. The module recalls ongoing and continuous compliance and the NCA's means of assessment: self-assessment, compliance tool reports and field audits. It sets out the four-part pattern of requirements, implementation, minimum and review, the six questions an assessor will ask, and what the guide expects of periodic review. Sterling's recommended evidence register is shown with owners across cybersecurity, HR, IT, procurement and facilities, and a row for log retention. Readiness steps include a half-day mock field visit to the data centre, monitoring room and camera records room. A Hong Kong office that copied the guide's wording, a four-phase road map, the project-not-cycle mistake, a first ninety days plan, a London office's undated screenshots and the final practice exercise close the course.

What you will be able to do

• Build an evidence register with an owner, date and review date for every control
• Rehearse an NCA field visit and turn every gap into an owned, dated action
• Draw up a phased, dated ECC road map from your own gap assessment

Why it matters

Leaves the entity ready for an NCA self-assessment or field audit at any time, with current, dated evidence and a road map it can deliver.

Practice: Practice: Evidence, readiness and your road map · 3 questions